Methods and apparatus to detect deepfake content

ABSTRACT

Methods, apparatus, systems and articles of manufacture are disclosed to detect deepfake content. An example apparatus to determine whether input media is authentic includes a classifier to generate a first probability based on a first output of a local binary model manager, a second probability based on a second output of a filter model manager, and a third probability based on a third output of an image quality assessor, a score analyzer to obtain the first, second, and third probabilities from the classifier, and in response to obtaining a first result and a second result, generate a score indicative of whether the input media is authentic based on the first result, the second result, the first probability, the second probability, and the third probability.

RELATED APPLICATION

This patent arises from a continuation of U.S. Provisional PatentApplication Serial No. 62/908,570, which was filed on Sep. 30, 2019.U.S. Provisional Patent Application Serial No. 62/908,570 is herebyincorporated herein by reference in its entirety. Priority to U.S.Provisional Patent Application Serial No. 62/908,570 is hereby claimed.

FIELD OF THE DISCLOSURE

This disclosure relates generally to artificial intelligence, and, moreparticularly, to methods and apparatus to detect deepfake content.

BACKGROUND

A deepfake is media (e.g., an image, video, and/or audio) that wasgenerated and/or modified using artificial intelligence. In someexamples, a deepfake creator may combine and/or superimpose existingimages and/or video onto a source image and/or video to generate thedeepfake. As artificial intelligence (e.g., neural networks, deeplearning, machine learning, and/or any other artificial intelligencetechnique) advances, deepfake media has become increasingly realisticand may be used to generate fake news, pranks, and/or fraud.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a block diagram of an example environment includingan example server, an example AI trainer, an example network, an exampleprocessing device, and an example deepfake analyzer.

FIG. 2A is block diagram of an example implementation of the deepfakeanalyzer of FIG. 1.

FIG. 2B is a block diagram of another example implementation of thedeepfake analyzer of FIGS. 1 and 2A.

FIG. 3 is a block diagram of an example implementation of the AI trainerof FIG. 1.

FIG. 4 illustrates an example eye and corresponding points used tocalculate an example eye aspect ratio.

FIG. 5 illustrates example patterns generated by the local binary modelmanager.

FIG. 6 illustrates an example input media processed by the example localbinary model manager of FIGS. 2A and/or 2B.

FIG. 7 illustrates example resultant patterns generated the filter modelmanager of FIGS. 2A and/or 2B.

FIG. 8 illustrates features extracted for use by the image qualityassessor of FIGS. 2A and/or 2B to perform image quality assessment.

FIG. 9 includes example results obtained and/or otherwise produced bythe deepfake analyzer of FIGS. 1, 2A, and/or 2B.

FIG. 10 is a flowchart representative of example machine readableinstructions that may be executed by a processor to implement theexample deepfake analyzer of FIGS. 1, 2A, and/or 2B to process inputmedia.

FIG. 11 is a flowchart representative of example machine readableinstructions that may be executed by a processor to implement theexample deepfake analyzer of FIGS. 1, 2A, and/or 2B to process inputmedia.

FIG. 12 is a block diagram of an example processor platform structuredto execute the instructions of FIGS. 10 and/or 11 to implement thedeepfake analyzer of FIGS. 1, 2A, and/or 2B.

FIG. 13 is a block diagram of an example software distribution platformto distribute software (e.g., software corresponding to the examplecomputer readable instructions of FIGS. 10 and/or 11) to client devicessuch as consumers (e.g., for license, sale and/or use), retailers (e.g.,for sale, re-sale, license, and/or sub-license), and/or originalequipment manufacturers (OEMs) (e.g., for inclusion in products to bedistributed to, for example, retailers and/or to direct buy customers).

The figures are not to scale. Instead, the thickness of the layers orregions may be enlarged in the drawings. Although the figures showlayers and regions with clean lines and boundaries, some or all of theselines and/or boundaries may be idealized. In reality, the boundariesand/or lines may be unobservable, blended, and/or irregular. In general,the same reference numbers will be used throughout the drawing(s) andaccompanying written description to refer to the same or like parts. Asused herein, unless otherwise stated, the term “above” describes therelationship of two parts relative to Earth. A first part is above asecond part, if the second part has at least one part between Earth andthe first part. Likewise, as used herein, a first part is “below” asecond part when the first part is closer to the Earth than the secondpart. As noted above, a first part can be above or below a second partwith one or more of: other parts therebetween, without other partstherebetween, with the first and second parts touching, or without thefirst and second parts being in direct contact with one another. As usedin this patent, stating that any part (e.g., a layer, film, area,region, or plate) is in any way on (e.g., positioned on, located on,disposed on, or formed on, etc.) another part, indicates that thereferenced part is either in contact with the other part, or that thereferenced part is above the other part with one or more intermediatepart(s) located therebetween. As used herein, connection references(e.g., attached, coupled, connected, and joined) may includeintermediate members between the elements referenced by the connectionreference and/or relative movement between those elements unlessotherwise indicated. As such, connection references do not necessarilyinfer that two elements are directly connected and/or in fixed relationto each other. As used herein, stating that any part is in “contact”with another part is defined to mean that there is no intermediate partbetween the two parts.

Unless specifically stated otherwise, descriptors such as “first,”“second,” “third,” etc. are used herein without imputing or otherwiseindicating any meaning of priority, physical order, arrangement in alist, and/or ordering in any way, but are merely used as labels and/orarbitrary names to distinguish elements for ease of understanding thedisclosed examples. In some examples, the descriptor “first” may be usedto refer to an element in the detailed description, while the sameelement may be referred to in a claim with a different descriptor suchas “second” or “third.” In such instances, it should be understood thatsuch descriptors are used merely for identifying those elementsdistinctly that might, for example, otherwise share a same name. As usedherein, “approximately” and “about” refer to dimensions that may not beexact due to manufacturing tolerances and/or other real worldimperfections. As used herein “substantially real time” refers tooccurrence in a near instantaneous manner recognizing there may be realworld delays for computing time, transmission, etc. Thus, unlessotherwise specified, “substantially real time” refers to real time +/−1second.

DETAILED DESCRIPTION

As software tools advance and are widely distributed and shared, theability for users to use such software for a malicious purpose alsoincreases. For example, the production and quality of deepfakes hassignificantly increased with advances in software. Deepfakes may begenerated to depict fake videos of people (e.g., celebrities orpoliticians) that appear to misrepresent them by manipulating theiridentity, words, and/or actions (e.g., show the people saying or doingthings that that they did not actually say). Deepfakes are becomingincreasingly realistic as artificial intelligence technology advances.Being able to identify and detect deepfakes accurately is importantbecause deepfakes could be detrimental (e.g., used to create a lot ofharm, fake emergency alerts, fake videos to destroy someone'sreputation, or fake video and/or audio of politicians during anelection).

Similarly, the production of spoof attacks has increased significantlywith advances in software. Spoof attacks are a type of adversarialattack based on techniques involving high definition photographs,three-dimensional (3D) masks, video-replay attacks using high resolutionscreens, etc. Often, spoof attacks involve methods to trick facialrecognition systems and/or biometric systems. For example, facialrecognition systems and/or biometric systems can face attacks such as apresentation attack and/or a database attack. In a presentation attack,an attacker pretends to be an authenticated user by tricking the facialrecognition system and/or biometric system into granting them access byusing either a photograph, mask, and/or video of the authenticated user.In a database attack, the attacker tampers with communication betweenthe biometric sensor and/or feature extractor to insert fake biometricsdata into the database. In face recognition systems, replay attacks (inwhich a pre-recorded video of the user is played out) and printedphotograph attacks are the two types of attacks.

Deepfakes, on the other hand, are often created using a generativeadversarial network (GAN) and other machine learning techniques. GAN'sare typically composed of two neural networks, a generator network and adiscriminator network. During a training operation of a GAN, thegenerator attempts to model a distribution of individual classes whilethe discriminator attempts to learn the boundary between classes. Theoutcome of this process is that the generator learns how to createhighly authentic data. In the context of deepfakes, a generator learnshow to generate fake content (e.g., a fake face, a deepfake, etc.) thatlooks like authentic content (e.g., an authentic face, etc.).

Because deepfakes are superior, in the degree of deception, to spoofattacks, it is difficult for humans to identify real media versusdeepfake media. In addition, artificial intelligence can be used toprocess media to be able to identify media as real or deepfake. Forexample, a neural network (e.g., convolution neural network (CNN)) maybe trained based on known real and deepfake media so that the multiplelayers of deep learning of the CNN can receive input media and identifywhether the input media is real or a deepfake.

Some approaches to detect malicious attacks involve utilizing computervision techniques to identify reflection of light off an object in animage. In this manner, such approaches are targeted towards spoofattacks and identify two-dimensional (2D) photographs from real faces.For example, such an approach may attempt to identify whether there areinconsistent shadows and/or a light projection on a face. However, suchapproaches do not target deepfake attacks.

Another approach to detect malicious attacks involves using a RecurrentNeural Network (RNN) to detect eye-blinking. Considering theimprovements in adversarial deepfakes, detecting the presence ofeye-blinks is no longer a viable solution for deepfakes. Furthermore,such an approach tends to produce a high false positive rate when thecontent (e.g., a deepfake video) is short in duration.

Examples disclosed herein include methods and apparatus to detectdeepfake content. Examples disclosed herein utilize computer visiontechniques such as, for example, facial recognition, Gabor filters,Image Quality Assessment, Local Binary Patterns, Blur Detection usingLaplacian Variance, etc., to analyze various patterns introduced in avideo. Furthermore, examples disclosed herein utilize a scoringtechnique based on the above-mentioned techniques to identify whether avideo is malicious (e.g., a fake video, a deepfake, etc.), or authentic(e.g., real). As a result, examples disclosed herein enable accuratedetection of a deepfake video. As used herein, malicious media may referto any media that is fake, artificially generated, manufactured toportray images, video and/or audio that portray events or sounds thatdid not actually occur, not real (e.g., a deepfake), etc.

Examples disclosed herein include utilizing an example image qualityassessor to determine and/or otherwise identify pixel intensities of anexample input media. Examples disclosed herein include normalizing pixelintensities of an input media and calculating pixel distribution overthe normalized intensities. Because malicious videos (e.g., fake videos,deepfakes, etc.), are not naturally shot and, instead, are generatedusing a ML algorithm, such generated videos will be prone to havingnoise captured in the training data of the source video. Typically,authentic and/or otherwise real videos (e.g., authentic and/or otherwisereal input media) include pixel intensities that follow a Gaussiandistribution after normalization. On the contrary, malicious (e.g.,fake, deepfake, etc.) videos often include pixel intensities that do notfollow a Gaussian Distribution after normalization. In examplesdisclosed herein, the deviation of the distribution from an idealdepiction (e.g., a bell curve) is a measure of the amount of distortionintroduced in a generated video.

An example apparatus disclosed herein includes an eye detection modelmanager to generate a first result based on an eye aspect ratiocorresponding to input media, a blur detection model manager to generatea second result based on determining a blur value corresponding to theinput media, a local binary model manager to generate a third resultbased on identifying local binary patterns of the input media, a filtermodel manager to generate a fourth result based on applying a filter tothe input media, an image quality assessor to generate a fifth resultbased on extracting features of the input media, and a score analyzer togenerate a score indicative of whether the input media is authenticand/or real based on the first result, the second result, the thirdresult, the fourth result, and the fifth result.

FIG. 1 illustrates a block diagram of an example environment 100including an example server 102, an example AI trainer 104, an examplenetwork 106, an example processing device 108, and an example deepfakeanalyzer 110. Although the example environment 100 illustrates thedeepfake analyzer 110 in the example processing device 108, the exampledeepfake analyzer 110 may additionally or alternatively be implementedin the example server 102, as further described below.

The example server 102 of FIG. 1 includes the example AI trainer 104.The AI trainer 104 trains an example AI model 112 based on an exampleinput dataset 114. In the example illustrated in FIG. 1, the inputdataset 114 may be a dataset of pre-classified media. For example, theinput dataset 114 may include 10,000 video frames that have already beencorrectly identified as real or a deepfake. The AI trainer 104 mayutilize all or part of the input dataset 114 to train the AI model 112to learn to classify video frames based on the characteristics of thevideo frames and corresponding classifications in the known data set. Insome examples, the training of the AI model 112 (e.g., a deepfakeclassification model) includes using a portion of the input dataset 114for training and a portion of the input dataset 114 for testing the AImodel 112. In this manner, the AI trainer 104 can use anymisclassifications (e.g., false negatives or false positives) duringtraining of the AI model 112 to tune the AI model 112 to avoid futuremisclassifications.

Once the example AI trainer 104 trains the AI model 112, the AI trainer104 deploys the AI model 112 so that it can be implemented on anotherdevice (e.g., the example processing device 108). For example, the AItrainer 104 transmits the AI model 112 to the processing device 108 viathe network 106 to facilitate deepfake detection. In some examples, theAI model 112 corresponds to a set of weights that are applied to neuronsin a convolutional neural network (CNN). Accordingly, the example AItrainer 104 can deploy the AI model 112 by generating and transmittingdata (e.g., data packets, instructions, executables, etc.) thatidentifies how to weight the neurons of a CNN to implement the AI model112. When the example processing device 108 receives thedata/instructions/executables (e.g., the AI model 112), the processingdevice 108 can execute the instructions to adjust the weights of anexample processing model 116 so that the processing model 116 implementsthe functionality of the trained, AI model 112. The example server 102and/or the example AI trainer 104 of the illustrated example of FIG. 1is/are implemented by a logic circuit such as, for example, a hardwareprocessor. However, any other type of circuitry may additionally oralternatively be used such as, for example, one or more analog ordigital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

The example network 106 of FIG. 1 is a system of interconnected systemsexchanging data. The example network 106 may be implemented using anytype of public or private network such as, but not limited to, theInternet, a telephone network, a local area network (LAN), a cablenetwork, and/or a wireless network. To enable communication via thenetwork 106, the example processing device 108 and/or the server 102include(s) a communication interface that enables a connection to anEthernet, a digital subscriber line (DSL), a telephone line, a coaxialcable, or any wireless connection, etc.

The example processing device 108 of FIG. 1 is a computing device thatreceives instructions, data, and/or executables corresponding to the AImodel 112. The deepfake analyzer 110 of the processing device 108 usesthe instructions, data, and/or executable to implement the AI model 112locally at the processing device 108. The example processing device 108of FIG. 1 is a computer. Alternatively, the example processing device108 may be a laptop, a tablet, a smart phone, a personal processor, aserver, and/or any other type of processing device. In this example, theexample processing device 108 includes the example deepfake analyzer110. The example processing device 108 of the illustrated example ofFIG. 1 is implemented by a logic circuit such as, for example, ahardware processor. However, any other type of circuitry mayadditionally or alternatively be used such as, for example, one or moreanalog or digital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

In the example of FIG. 1, the example deepfake analyzer 110 configuresthe processing model 116 (e.g., a neural network) to implement the AImodel 112. For example, the deepfake analyzer 110 adjusts the weights ofthe neurons in the processing model 116 based on the receivedinstructions (e.g., the AI model 112). In response to implementing theAI model 112 using the processing model 116, the deepfake analyzer 110obtains example input media 118. Using the obtained input media 118, thedeepfake analyzer 110 generates an output (e.g., a score) identifyingwhether the input media 118 is authentic or fake (e.g., a deepfake). Insome such examples, if the score is between 0 and 0.5 (e.g., greaterthan or equal to 0 and less than or equal to 0.5), the deepfake analyzer110 classifies the media as a deepfake. Alternatively, if the score isbetween 0.5 and 1 (e.g., greater than 0.5 and less than or equal to 1),the deepfake analyzer 110 classifies the media as authentic. The exampledeepfake analyzer 110 generates a report including the classificationand transmits the report to the example AI trainer 104 at the server102. Additional description of the deepfake analyzer 110 is describedbelow in connection with FIGS. 2A and/or 2B.

In some examples, the deepfake analyzer 110 of FIG. 1 may be implementedin the AI trainer 104. For example, the deepfake analyzer 110 may beutilized to provide feedback when testing the AI model 112. In such anexample, the server 102 may include a database (e.g., memory) includinga training dataset of, for example, 1000 images and/or video frames.Some of the images are authentic while others are deepfakes. Theclassifications (e.g., authentic vs. deepfake) are known to the AItrainer 104 prior to training. Once the initial training is complete,the initially trained AI model 112 is implemented in the deepfakeanalyzer 110.

In operation, the example AI trainer 104 obtains the input dataset 114for use in training the AI model 112. Once trained, the AI trainer 104may transmit, or the example processing device 108 may request, the AImodel 112 to the processing device 108. In this manner, the deepfakeanalyzer 110, using the AI model 112, can adjust weights in theprocessing model 116. Accordingly, using the processing model 116, thedeepfake analyzer 110 is configured to determine whether example inputmedia 118 is authentic or fake (e.g., a deepfake).

FIG. 2A is block diagram of an example implementation of the deepfakeanalyzer 110 of FIG. 1. The example deepfake analyzer 110 includes anexample network interface 200, an example component interface 202, anexample eye detection model manager 204, an example blur detection modelmanager 206, an example local binary model manager 208, an examplefilter model manager 210, an example image quality assessor 212, anexample classifier 214, an example score analyzer 216, an example reportgenerator 218, and an example data store 220. In other examplesdisclosed herein, the deepfake analyzer 110 may include a facialdetector configured to obtain the input media 118 of FIG. 1 and detectfacial features and/or facial outlines. Such detected facial featuresand/or facial outlines may be transmitted to any of the example networkinterface 200, the example component interface 202, the example eyedetection model manager 204, the example blur detection model manager206, the example local binary model manager 208, the example filtermodel manager 210, the example image quality assessor 212, the exampleclassifier 214, the example score analyzer 216, the example reportgenerator 218, and the example data store 220.

The example network interface 200 of FIG. 2A obtains the example AImodel 112 from the example AI trainer 104 via the example network 106.For example, the network interface 200 may receive the AI model 112(e.g., instructions that identify a set of weights to apply to theneurons of a CNN to implement the trained model) from the example AItrainer 104. The AI model 112 corresponds to instructions to implementthe processing model 116 based on training that occurred at the AItrainer 104. Additionally, the network interface 200 is configured toobtain example input media 118. In examples disclosed herein, the inputmedia 118 may be any suitable media (e.g., a video, a picture, etc.) inwhich the deepfake analyzer 110 is to determine whether the media isauthentic or a deekfake.

Additionally, the network interface 200 may transmit reports to theexample AI trainer 104. For example, when the example classifier 214classifies the input media 118, the report generator 218 may generate areport identifying or otherwise including the input media 118 and thecorresponding classification (e.g., authentic/deepfake and/or theclassification score). The example network interface 200 can transmitthe report to the AI trainer 104 to provide feedback for subsequenttraining and/or modifying of the AI model 112. The example networkinterface 200 of the illustrated example of FIG. 2A is implemented by alogic circuit such as, for example, a hardware processor. However, anyother type of circuitry may additionally or alternatively be used suchas, for example, one or more analog or digital circuit(s), logiccircuits, programmable processor(s), application specific integratedcircuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), fieldprogrammable logic device(s) (FPLD(s)), digital signal processor(s)(DSP(s)), etc.

The example component interface 202 of FIG. 2A transmits and/or receivesdata to/from other components of the example processing device 108and/or the AI trainer 104 (e.g., when the deepfake analyzer 110 isimplemented in the example server 102). For example, the componentinterface 202 may receive media (e.g., images, video, and/or audio) thatis stored in and/or received by the example processing device 108 fordeepfake classification. When the example deepfake analyzer 110 isimplemented in the example server 102, the component interface 202 mayreceive the AI model 112 and provide feedback (e.g., reports) to theexample AI trainer 104. In some examples, the component interface 202may store reports generated by the report generator 218 in the exampledata store 220. The example component interface 202 of the illustratedexample of FIG. 2A is implemented by a logic circuit such as, forexample, a hardware processor. However, any other type of circuitry mayadditionally or alternatively be used such as, for example, one or moreanalog or digital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

The example eye detection model manager 204 of FIG. 2A is configured todetect a human face in the input media 118. In examples disclosedherein, the eye detection model manager 204 detects a human face usingHaar features. As used herein, Haar features refer to image featuresthat are used when determining boundaries and/or objects in an image.The eye detection model manager 204 further identifies and/or otherwisedetermines facial landmarks (e.g., a nose, eyes, mouth, etc.). In someexamples disclosed herein, the eye detection model manager 204 mayidentify and/or otherwise determine facial landmarks using a toolkitsuch as dlib C++. In response to identifying and/or otherwisedetermining the facial landmarks, the eye detection model manager 204extracts a portion of the input media 118 that represents the eyes. Inother examples disclosed herein, the eye detection model manager 204 isconfigured to obtain data corresponding to a detected human face from aface detector implementing a facial recognition technique. In such amanner, the eye detection model manager 204 determines (e.g.,calculates) an eye aspect ratio (EAR). The eye aspect ratio can bedetermined by the eye detection model manager 204 using the belowequation, equation 1.

$\begin{matrix}{{EAR} = \frac{{{{p\; 2} - {p\; 6}}} + {{{p\; 3} - {p\; 5}}}}{2{{{p\; 1} - {p\; 4}}}}} & {{Equation}\mspace{14mu} 1}\end{matrix}$

In equation 1, the variable EAR corresponds to the eye aspect ratio andthe variables p1, p2, p3, p4, p5, and p6 correspond to identified pointsin the eye, as illustrated in FIG. 4.

In examples disclosed herein, the eye detection model manager 204detects whether a blink occurred if the EAR satisfies a threshold. Forexample, if the EAR is less than a threshold, the eye detection modelmanager 204 may determine a blink occurred. In a further example, thethreshold may be 0.25 based on a time of four frames. As such, if theEAR is less than 0.25 for four consecutive frames of a video, the eyedetection model manager 204 may identify a blink occurred. In examplesdisclosed herein, the eye detection model manager 204 operates utilizinga facial landmarks predictor, EAR, and a threshold value to detect eyeblink. In the event the eye detection model manager 204 determines thatan eye blink occurred (e.g., the EAR satisfies a threshold), then theeye detection model manager 204 generates a result as a binary valueof 1. Alternatively, in the event the eye detection model manager 204determines that an eye blink did not occur (e.g., the EAR does notsatisfy a threshold), then the eye detection model manager 204 generatesa result as a binary value of 0. In examples disclosed herein, the eyedetection model manager 204 transmits the result to the score analyzer216.

In other examples disclosed herein, in the event the eye detection modelmanager 204 determines that an eye blink occurred (e.g., the EARsatisfies a threshold), then the eye detection model manager 204generates a result as a binary value of 0, and/or any suitable resultindicating an eye blink has occurred. In other examples disclosedherein, in the event the eye detection model manager 204 determines thatan eye blink did not occur (e.g., the EAR does not satisfy a threshold),then the eye detection model manager 204 generates a result as a binaryvalue of 1, and/or any suitable result indicating an eye blink has notoccurred.

In examples disclosed herein, the eye detection model manager 204 maydetermine a number of eye blinks in the input media 118 in the event theinput media 118 is a video. The example eye detection model manager 204of the illustrated example of FIG. 2A is implemented by a logic circuitsuch as, for example, a hardware processor. However, any other type ofcircuitry may additionally or alternatively be used such as, forexample, one or more analog or digital circuit(s), logic circuits,programmable processor(s), application specific integrated circuit(s)(ASIC(s)), programmable logic device(s) (PLD(s)), field programmablelogic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

The example blur detection model manager 206 of FIG. 2A is configured toconvolve the input media 118 by the Laplacian kernel to calculate thevariance of the result. In examples disclosed herein, the blur detectionmodel manager 206 may calculate the variance of the resultant 2D matrix(e.g., the matrix generated by convolving each frame of the video withthe Laplacian Kernel). An example Laplacian kernel is illustrated below,in Expression 1.

$\begin{matrix}\begin{pmatrix}0 & 1 & 0 \\1 & {- 4} & 1 \\0 & 1 & 0\end{pmatrix} & {{Expression}\mspace{14mu} 1}\end{matrix}$

As such, the example blur detection model manager 206 may be utilized toidentify degree of blur involved in input media 118 based on thevariance. In examples disclosed herein, the blur detection model manager206 identifies the degree of blur for each frame in the input media 118.Accordingly, the blue detection model manager 206 generates an exampleresult to be sent to the score analyzer 216. In examples disclosedherein, the result generated by the blur detection model manager 206 isan average result of the degree of blur across all frames in the inputmedia 118. The blur detection model manager 206 implements blurdetection techniques using Laplacian kernels. However, in other examplesdisclosed herein, the blur detection model manager 206 may be a machinelearning model, a deep learning model, another type of neural network,and/or any other type of model and/or network. The example blurdetection model manager 206 of the illustrated example of FIG. 2A isimplemented by a logic circuit such as, for example, a hardwareprocessor. However, any other type of circuitry may additionally oralternatively be used such as, for example, one or more analog ordigital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

In FIG. 2A, the local binary model manager 208 obtains and/or otherwiseidentifies a pattern in the input media 118 to assist in distinguishingbetween a real and a malicious (e.g., a deepfake, etc.) video. Theexample local binary model manager 208 of FIG. 2A is implemented using aneural network. For example, the local binary model manager 208 may be amachine learning model, a deep learning model, another type of neuralnetwork, and/or any other type of model and/or network. Initially, theexample local binary model manager 208 is not initialized with anyweights (e.g., the neurons are not yet weighted). However, in responseto the network interface 200 obtaining the AI model 112 from the server102, the local binary model manager 208 is configured to operateaccording to the AI model 112 generated by the example AI trainer 104.For example, neurons of the example local binary model manager 208 areweighted based on the AI model 112.

Once trained, the example local binary model manager 208 obtains theinput media 118 (e.g., images, video frames, and/or audio) from thecomponent interface 202. The local binary model manager 208 executes aLocal Binary Pattern (LBP) technique to compute a local representationof texture of a frame of the input media 118. For example, the localbinary model manager 208 compares each pixel with its surroundingneighborhood of pixels in the input media 118. In addition, the localbinary model manager 208 produces a histogram corresponding to variousfeatures and/or changes in texture in the input media 118. In examplesdisclosed herein, the local binary model manager 208 executes an LBPoperation for each frame in the input media 118. Accordingly, the localbinary model manager 208 generates histogram to be sent to theclassifier 214. In examples disclosed herein, the histogram generated bythe local binary model manager 208 may be referred to as a result of thelocal binary model manager 208. In examples disclosed herein, the resultgenerated by the local binary model manager 208 is an average resultacross all frames in the input media 118.

In examples disclosed herein, the local binary model manager 208transmits the histogram to the classifier 214. Example results of thelocal binary model manager 208 are described below, in connection withFIGS. 5 and/or 6. The example local binary model manager 208 of theillustrated example of FIG. 2A is implemented by a logic circuit suchas, for example, a hardware processor. However, any other type ofcircuitry may additionally or alternatively be used such as, forexample, one or more analog or digital circuit(s), logic circuits,programmable processor(s), application specific integrated circuit(s)(ASIC(s)), programmable logic device(s) (PLD(s)), field programmablelogic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

The example filter model manager 210 of FIG. 2A is implemented using aneural network model. For example, the filter model manager 210 may be amachine learning model, a deep learning model, another type of neuralnetwork, and/or any other type of model and/or network. Initially, theexample filter model manager 210 is not initialized with any weights(e.g., the neurons are not yet weighted). However, in response to the AImodel 112 being obtained by the network interface 200, the filter modelmanager 210 is configured to operate according to the AI model 112generated by the example AI trainer 104. For example, neurons of theexample filter model manager 210 are weighted based on the AI model 112.

Once trained, the example filter model manager 210 obtains the inputmedia 118 (e.g., images, video frames, and/or audio) from the componentinterface 202. In an example operation, the filter model manager 210applies Gabor filters to the input media 118 by convolving a kernel ormask with the input media 118 which, in turn, filters certainfrequencies or signals from the input media 118. When the filter modelmanager 210 applies a Gabor filter to the input media 118, the result isa corresponding combination of signals extracted from the frame(s) ofthe input media 118. In this manner, the filter model manager 210convolves the array over every pixel of the input media 118. Such aprocess performed by the filter model manager 210 may be done for eachframe of the input media 118. The filter model manager 210 may extractcorresponding signals utilizing the below equation, equation 2.

$\begin{matrix}{{g\left( {x,{y;\lambda},\theta,\psi,\sigma,\gamma} \right)} = {{\exp \left( {- \frac{x^{\prime 2} + {\gamma^{2}y^{\prime 2}}}{2\sigma^{2}}} \right)}{\exp \left( {i\left( {{2\pi \frac{x^{\prime}}{\lambda}} + \psi} \right)} \right)}}} & {{Equation}\mspace{14mu} 2}\end{matrix}$

In equation 2, the variables x and y correspond to the size of the Gaborkernel. In examples disclosed herein, the size of the Gabor kernel isset to 21. In other examples disclosed herein, any suitable Gabor kernelsize may be utilized.

In equation 2, the variable a corresponds to the standard deviation ofthe Gaussian function used in the Gabor filter. In examples disclosedherein, σ is 5. However, in other examples disclosed herein, anysuitable value for σ may be used.

In equation 2, the variable θ corresponds to the orientation of thenormal to the parallel stripes of the Gabor function. In examplesdisclosed herein, θ corresponds to sixteen values to result in sixteendifferent filters (e.g., 0, 11.25, 22.5, 33.75, 45, 56.25, 67.5, 78.75,90, 101.25, 112.5, 135, 146.25, 157.5, 168.75, 180). In other examplesdisclosed herein, any number of values and/or value magnitude may beused for θ.

In equation 2, the variable λ corresponds to the wavelength of thesinusoidal factor in the above equation. In examples disclosed herein, λis 31. However, in other examples disclosed herein, any suitable valuefor λ may be used.

In equation 2, the variable γ corresponds to the spatial aspect ratio.In examples disclosed herein, γ is 0.5. However, in other examplesdisclosed herein, any suitable value for γ may be used.

In equation 2, the variable ψ corresponds to the phase offset. Inexamples disclosed herein, ψ is 75. However, in other examples disclosedherein, any suitable value for ψ may be used.

Furthermore, the filter model manager 210 extracts a combination ofsignals related to edges at different orientations and/or texturechanges at different orientations by altering the value of theta tosixteen equally distributed values from zero to one hundred and eightydegrees.

In examples disclosed herein, the filter model manager 210 convolves thefiltered input media 118 with a gray image or frame (e.g., a 2D array)to obtain a histogram representative of a signal. In examples disclosedherein, the histogram generated by the filter model manager 210 may bereferred to as a result of the filter model manager 210. In examplesdisclosed herein, the result generated by the filter model manager 210is an result across all frames in the input media 118. For example, thefilter model manager 210 may generate an individual result for eachframe of the input media 118. In this manner, the result transmitted bythe filter model manager 210 may be an average value of the individualresults across each frame of the input media 118.

In examples disclosed herein, the filter model manager 210 transmits thehistogram to the classifier 214. Example results of the filter modelmanager 210 are described below, in connection with FIG. 7.

The example filter model manager 210 of the illustrated example of FIG.2A is implemented by a logic circuit such as, for example, a hardwareprocessor. However, any other type of circuitry may additionally oralternatively be used such as, for example, one or more analog ordigital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

In the example illustrated in FIG. 2A, the image quality assessor 212 isimplemented using a neural network. For example, the image qualityassessor 212 may be a machine learning model, a deep learning model,another type of neural network, and/or any other type of model and/ornetwork. Initially, the example image quality assessor 212 is notinitialized with any weights (e.g., the neurons are not yet weighted).However, in response to the network interface 200 obtaining the AI model112 from the server 102, the image quality assessor 212 is configured tooperate according to the AI model 112 generated by the example AItrainer 104. For example, neurons of the example image quality assessor212 are weighted based on the AI model 112.

Once trained, the example image quality assessor 212 obtains input media118 (e.g., images, video frames, and/or audio) from the componentinterface 202. In operation, the example image quality assessor 212extracts different features from the input media 118 by fitting theinput media 118 to a distribution (e.g., a Generalized GaussianDistribution and an Asymmetric Gaussian Distribution). In examplesdisclosed herein, the image quality assessor 212 utilizes techniquessuch as, for example, BRISQUE, as an approach to an image qualityassessment algorithms (e.g., Peak Signal to Noise Ratio and StructuralSimilarity Index). In examples disclosed herein, the features extractedby the image quality assessor 212 may be referred to as a result of theimage quality assessor 212. In examples disclosed herein, the resultgenerated by the image quality assessor 212 is an average result acrossall frames in the input media 118.

In examples disclosed herein, the image quality assessor 212 transmitsthe result (e.g., the extracted features) to the classifier 214. Theexample image quality assessor 212 of the illustrated example of FIG. 2Ais implemented by a logic circuit such as, for example, a hardwareprocessor. However, any other type of circuitry may additionally oralternatively be used such as, for example, one or more analog ordigital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

In the example illustrated in FIG. 2A, the classifier 214 is implementedusing a tree-based classification model such as, for example, a randomforest. In other examples disclosed herein, the classifier 214 may beimplemented using a neural network. In such examples, the classifier 214may be a machine learning model, a deep learning model, another type ofneural network, and/or any other type of model and/or network. Furtherin such an example, the example classifier 214 is not initialized withany weights (e.g., the neurons are not yet weighted). However, inresponse to the network interface 200 obtaining the AI model 112 fromthe server 102, the classifier 214 is configured to operate according tothe AI model 112 generated by the example AI trainer 104. For example,neurons of the example classifier 214 are weighted based on the AI model112.

In operation, the classifier 214 obtains outputs (e.g., results) of thelocal binary model manager 208 (e.g., a histogram corresponding tovarious features and/or changes in texture), the filter model manager210 (e.g., a histogram corresponding to a final signal of the filtermodel manager 210), and the image quality assessor 212 (e.g., extractedfeatures). In addition, in some examples disclosed herein, theclassifier 214 obtains the output of the eye detection model manager204. As such, the classifier 214 generates a probability based on eachof the outputs (e.g., results) from the local binary model manager 208(e.g., a histogram corresponding to various features and/or changes intexture), the filter model manager 210 (e.g., a histogram correspondingto a final signal of the filter model manager 210), the image qualityassessor 212 (e.g., extracted features), and/or the eye detection modelmanager 204 (e.g., an indication corresponding to whether a blinkoccurred). Such generated probabilities correspond to a likelihood ofthe input media 118 being authentic or a deepfake. In examples disclosedherein, the classifier 214 transmits the probabilities to the scoreanalyzer 216.

In some examples disclosed herein, the classifier 214 may utilizedeepfake video datasets such as, for example, VidTimit and/or UADFV, tobe trained. The classification algorithm utilized may be, for example,the Scikit Learning implementation of Random Forest. In examplesdisclosed herein, the training parameters may be the following:

n_estimators=20

max_depth=22

min_samples split=10

The example classifier 214 of the illustrated example of FIG. 2A isimplemented by a logic circuit such as, for example, a hardwareprocessor. However, any other type of circuitry may additionally oralternatively be used such as, for example, one or more analog ordigital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

In other examples disclosed herein, any of the local binary modelmanager 208, the filter model manager 210, and/or the image qualityassessor 212 may include the example classifier 214.

In the illustrated example of FIG. 2A, the score analyzer 216 utilizesan algorithm to combine the result of the eye detection model manager204, the result of the blur detection model manager 206, the probabilitygenerated by the classifier 214 corresponding to the result of the localbinary model manager 208, the probability generated by the classifier214 corresponding to the result of the filter model manager 210, and/orthe probability generated by the classifier 214 corresponding to theresult of the image quality assessor 212 to generate a score. Inexamples disclosed herein, the score analyzer 216 may utilize thefollowing equation, equation 3, to generate the score.

Score=G*AvgGabor+I*AvgIQ+B*AvgBlur+EBC*EyeBlinkingDetector+LBP*AvgLBP  Equation 3

In equation 3, the variable G corresponds to the Gabor coefficient, thevariable I corresponds to the Image Quality coefficient, the variable Bcorresponds to the Blur coefficient, the variable EBC corresponds to theEye Blinking coefficient, the variable LPB corresponds to the LocalBinary Pattern coefficient. The variable EyeBlinkingDetector correspondsto the result of the eye detection model manager 204, the variableAvgBlur corresponds to the average degree of blur based on the result ofthe blur detection model manager 206, the variable AvgLBP corresponds tothe probability generated by the classifier 214 based on the result ofthe local binary model manager 208, the variable AvgGabor corresponds tothe probability generated by the classifier 214 based on the result ofthe filter model manager 210, and the variable AvgIQ corresponds to theprobability generated by the classifier 214 based on the result of theimage quality assessor 212.

In examples disclosed herein, the score has a lower bound of 0 and anupper bound of 1. For example, on examples disclosed herein, the scoreis normalized between 0 and 1. However, any other form of numericalprocessing may be utilized to adjust the score.

In some examples disclosed herein, the coefficients included in equation3 may be altered responsive to determining the variable AvgBlur.Examples below illustrate three formats corresponding to differentAvgBlur values. While it is noted the below formats include numericalcoefficients, any suitable numerical coefficient may be utilized.

Format 1: Average blur scores less than or equal to 20, GaborCoefficient (G)=1.6, Image Quality Coefficient (I)=1.8, Blur Coefficient(B)=0.01, Eye Blinking Coefficient (EBC)=0.1, Local Binary Patterns(LBP)=0.05.

Format 2: Average blur scores between 20 and 600, Gabor Coefficient(G)=2.2, Image Quality Coefficient (I)=2.0, Blur Coefficient (B)=0, EyeBlinking Coefficient (EBC)=0.1, Local Binary Patterns (LBP)=0.

Format 3: Average blur scores greater than 600, Gabor Coefficient (G)=2,Image Quality Coefficient (I)=2.2, Blur Coefficient (B)=(−0.05), EyeBlinking Coefficient (EBC)=0.1, Local Binary Patterns (LBP)=0.05.

In examples disclosed herein, the scoring technique may be enhancedbased on empirical testing of the above-mentioned techniques (e.g., thetechniques implemented by the deepfake analyzer 110, techniquesimplemented by the eye detection model manager 204, the blur detectionmodel manager 206, the local binary model manager 208, the filter modelmanager 210, the image quality assessor 212, and/or the classifier 214)on real videos and deepfake videos of different qualities. Suchenhancement enables the determination of threshold values. Additionally,this scoring technique includes weights for each individual technique(e.g., techniques implemented by the eye detection model manager 204,the blur detection model manager 206, the local binary model manager208, the filter model manager 210, the image quality assessor 212,and/or the classifier 214) according to performance in operation. Theexample score analyzer 216 of the illustrated example of FIG. 2A isimplemented by a logic circuit such as, for example, a hardwareprocessor. However, any other type of circuitry may additionally oralternatively be used such as, for example, one or more analog ordigital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

The example report generator 218 of FIG. 2A obtains the score from thescore analyzer 216. The report generator 218 determines whether (e.g.,classifies) the input media 118 is real or a deepfake based on the scorefrom the score analyzer 216. For example, if the score is greater thanor equal to 0 and less than or equal to 0.5, the report generator 218determines that the input media 118 is a deepfake. Alternatively, if thescore is between a 0.50 and a 1.0 (e.g., greater than 0.50 and less thanor equal to 1), the report generator 218 determines that the input media118 is authentic. The example report generator 218 generates a reportidentifying and/or including the input media 118 and/or theclassification. The example report generator 218 instructs the networkinterface 200 and/or the component interface 202 to transmit the reportto the example AI trainer 104. In some examples, the report generator218 instructs the component interface 202 to interface with storage tostore the report. The example report generator 218 of the illustratedexample of FIG. 2A is implemented by a logic circuit such as, forexample, a hardware processor. However, any other type of circuitry mayadditionally or alternatively be used such as, for example, one or moreanalog or digital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

In the example of FIG. 2A, the data store 220 is configured to store theAI model 112, the processing model 116, and/or the input media 118. Inaddition, the data store 220 may store any of the results obtained fromthe eye detection model manager 204, the blur detection model manager206, the local binary model manager 208, the filter model manager 210,the image quality assessor 212, the classifier 214, the score analyzer216, and/or the report generator 218. The example data store 220 of theillustrated example of FIG. 2A may be implemented by any device forstoring data such as, for example, flash memory, magnetic media, opticalmedia, etc. Furthermore, the data stored in the example data store 220may be in any data format such as, for example, binary data, commadelimited data, tab delimited data, structured query language (SQL)structures, etc.

FIG. 2B is a block diagram of another example implementation of thedeepfake analyzer 110 of FIGS. 1 and 2A. The illustration of FIG. 2Bincludes the eye detection model manager 204, the blur detection modelmanager 206, the local binary model manager 208, the filter modelmanager 210, the image quality assessor 212, the classifier 214, thescore analyzer 216, and the report generator 218. In FIG. 2B, the eyedetection model manager 204, the blur detection model manager 206, thelocal binary model manager 208, the filter model manager 210, the imagequality assessor 212, the classifier 214, the score analyzer 216, andthe report generator 218 are implemented in accordance with theteachings of this disclosure.

In the example of FIG. 2B, the classifier 214 obtains example resultsfrom the eye detection model manager 204, the local binary model manager208, the filter model manager 210, and/or the image quality assessor212. Additionally, the score analyzer 216 obtains the results from theeye detection model manager 204, the blur detection model manager 206and the classifier 214 to generate a result in accordance with theteachings of this disclosure.

FIG. 3 is a block diagram of an example implementation of the AI trainer104 of FIG. 1. The example AI trainer 104 includes an example deepfakeclassification model trainer 300, an example classification analyzer302, an example model modifier 304, an example network interface 306, anexample component interface 308, an example user interface 310, and anexample data store 312.

The example deepfake classification model trainer 300 of FIG. 3generates a model (e.g., the AI model 112) based on a dataset of media(e.g., the input dataset 114) that has known classifications (e.g.,known to be authentic or deepfake). The deepfake classification modeltrainer 300 trains based on the input dataset 114 to be able to classifysubsequent media as authentic or deepfake based on the characteristicsof the known dataset used to train the AI model 112. In some examples,the deepfake classification model trainer 300 trains using a portion ofthe input dataset 114. In this manner, the example deepfake analyzer 110can use the remaining portion of the input dataset 114 to test theinitially trained AI model 112 to verify the accuracy of the AI model112. The example deepfake classification model trainer 300 of theillustrated example of FIG. 3 is implemented by a logic circuit such as,for example, a hardware processor. However, any other type of circuitrymay additionally or alternatively be used such as, for example, one ormore analog or digital circuit(s), logic circuits, programmableprocessor(s), application specific integrated circuit(s) (ASIC(s)),programmable logic device(s) (PLD(s)), field programmable logicdevice(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

The example classification analyzer 302 of FIG. 3 analyzes theclassifications of media in the input dataset 114 using the AI model 112during testing. For example, after an initial training of the AI model112, a portion of the input dataset 114 with known classifications maybe used to test the initially trained AI model 112. In such an example,the classification analyzer 302 may obtain the results of theclassification of a particular media of the input dataset 114 from theinitially trained AI model 112 and compare to the known classificationof the particular media to determine if the initially trained AI model112 properly classifies the media.

In some examples, the classification analyzer 302 transmits a prompt toa user and/or administrator (e.g., via the user interface 310) to havethe user and/or administrator diagnose possible reasons for amisclassification. In this manner, the user and/or administrator caninstruct the model modifier 304 to tune or otherwise adjust the AI model112 based on the reasons for the misclassification. In some examples,the classification analyzer 302 automatically determines possiblereasons for the misclassification. The example classification analyzer302 of the illustrated example of FIG. 3 is implemented by a logiccircuit such as, for example, a hardware processor. However, any othertype of circuitry may additionally or alternatively be used such as, forexample, one or more analog or digital circuit(s), logic circuits,programmable processor(s), application specific integrated circuit(s)(ASIC(s)), programmable logic device(s) (PLD(s)), field programmablelogic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

The example model modifier 304 of FIG. 3 modifies (e.g., tunes oradjusts) the AI model 112 based on the reasons for a misclassification.For example, if the reasons for misclassification were due to the AImodel 112 using particular parts of an image that are deemed unimportantby the classification analyzer 302, a user, and/or an administrator, themodel modifier 304 adjusts the weights of the AI model 112 todeemphasize the unimportant parts. In some examples, the model modifier304 may adjust the AI model 112 based on results from deployed models.For example, if the AI model 112 is deployed to the deepfake analyzer110 in the processing device 108, the deepfake analyzer 110 may transmitreports to the example AI trainer 104. If there are deviations, themodel modifier 304 may adjust the AI model 112 based on the deviation.The example model modifier 304 of the illustrated example of FIG. 3 isimplemented by a logic circuit such as, for example, a hardwareprocessor. However, any other type of circuitry may additionally oralternatively be used such as, for example, one or more analog ordigital circuit(s), logic circuits, programmable processor(s),application specific integrated circuit(s) (ASIC(s)), programmable logicdevice(s) (PLD(s)), field programmable logic device(s) (FPLD(s)),digital signal processor(s) (DSP(s)), etc.

The example network interface 306 of FIG. 3 transmits and/or receivesdata to/from the example deepfake analyzer 110 via the example network106 (e.g., when the deepfake analyzer 110 is implemented in the exampleprocessing device 108). For example, the network interface 306 maytransmit the AI model 112 (e.g., instructions that includes a set ofweights to apply to the neurons of a CNN to implement the AI model 112)to the example processing device 108. Additionally, the networkinterface 306 may receive reports to the example deepfake analyzer 110.In the illustrated example, the network interface 306 is implemented bya WiFi radio that communicates with the deepfake analyzer 110. In someexamples, the network interface 306 facilitates wired communication viaan Ethernet network. In other examples disclosed herein, any other typeof wired and/or wireless transceiver may additionally or alternativelybe used to implement the network interface 306.

The example component interface 308 of FIG. 3 transmits and/or receivesdata to/from the example deepfake analyzer 110 (e.g., when the deepfakeanalyzer 110 is implemented in the example server 102). For example, thecomponent interface 308 transmits the AI model 112 to the exampledeepfake analyzer 110 and receives reports from the example deepfakeanalyzer 110. In the illustrated example, the component interface 308 isimplemented by a WiFi radio that communicates with the deepfake analyzer110. In some examples, the component interface 308 facilitates wiredcommunication via an Ethernet network. In other examples disclosedherein, any other type of wired and/or wireless transceiver mayadditionally or alternatively be used to implement the componentinterface 308.

The example user interface 310 of FIG. 3 interfaces with a user and/oradministrator to display a prompt showing input media, and/orcorresponding classification information. In this manner, the exampleuser and/or administrator interface with the user interface 310 toprovide in the event media is misclassified.

In the example of FIG. 3, the data store 312 is configured to store theAI model 112, the input dataset 114, and/or any report obtained from thedeepfake analyzer 110. The example data store 312 of the illustratedexample of FIG. 3 may be implemented by any device for storing data suchas, for example, flash memory, magnetic media, optical media, etc.Furthermore, the data stored in the example data store 312 may be in anydata format such as, for example, binary data, comma delimited data, tabdelimited data, structured query language (SQL) structures, etc.

While FIG. 3 illustrates a single AI trainer, any number of AI trainersmay be implemented corresponding to any of the example network interface200, the example component interface 202, the example eye detectionmodel manager 204, the example blur detection model manager 206, theexample local binary model manager 208, the example filter model manager210, the example image quality assessor 212, the example classifier 214,the example score analyzer 216, and the example report generator 218.

FIG. 4 illustrates an example eye 400 and corresponding points 402 a-fused to calculate an example eye aspect ratio. In the exampleillustrated in FIG. 4, the example eye detection model manager 204 ofFIGS. 2A and/or 2B identifies and/or otherwise determines the points 402a-f as landmarks of an the eye 400. In this manner, the eye detectionmodel manager 204 extracts the eye 400 from the input media 118. Inconnection with Equation 1, point 402 a may correspond to the variablep1, point 402 b may correspond to the variable p2, point 402c maycorrespond to the variable p3, point 402 d may correspond to thevariable p4, point 402 e may correspond to the point p5, and point 402 fmay correspond to the point p6.

FIG. 5 illustrates example patterns 500 generated by the local binarymodel manager 208. Illustrated in FIG. 5, the patterns 500 are generatedby the local binary model manager 208 in response to executing an LBPoperation. The example patterns 500 includes a first examplecharacterization 502, a second example characterization 504, a thirdexample characterization 506, a fourth example characterization 508, anda fifth example characterization 510.

In FIG. 5, the first example characterization 502 corresponds to thepattern, flat. The second example characterization 504 corresponds tothe pattern, flat, as depicted with the absence of pixels. The thirdexample characterization 506 corresponds to the pattern, edge. Thefourth example characterization 508 corresponds to the pattern, corner.The fifth example characterization 510 corresponds to the pattern,non-uniform.

FIG. 6 illustrates an example input media 602 processed by the examplelocal binary model manager 208 of FIGS. 2A and/or 2B. The input media602 of FIG. 6 may be the example input media 118 of FIG. 1. Illustratedin FIG. 6, the local binary model manager 208 obtains the input media602 and generates an example result image 604.

FIG. 7 illustrates example resultant patterns 700 generated the filtermodel manager 210 of FIGS. 2A and/or 2B. For example, FIG. 7 depicts theexample resultant patterns 700 obtained from the filter model manager210 applying sixteen Gabor filters. By using sixteen filters havingorientations equally distributed from zero to one hundred and eightydegrees, patterns can be obtained for a variety of orientations. In someexamples disclosed herein, the resultant patterns 700 are used by thefilter model manager 210 to generate a histogram for use by theclassifier 214.

FIG. 8 illustrates features extracted for use by the image qualityassessor 212 of FIGS. 2A and/or 2B to perform image quality assessment.In examples disclosed herein, features included in example columns 802,804, 806, 808, 810, 812, 814, 816, 818, 820, 822, and 824 (e.g., columns1, 4, 5, 7, 8, 9, 11, 12, 13, 15, 16, and 16) are utilized with higherdiscrimination power for deepfake and real videos. In other examplesdisclosed herein, any suitable feature may be utilized. While theexample of FIG. 8 includes feature values, such feature values areexamples and, as such, any suitable feature value (e.g., any suitablenumerical value) may be included and/or utilized. In some examplesdisclosed herein, results (e.g., extracted features) from the imagequality assessor 212 are provided to the classifier 214 to obtain theprobabilities for real or malicious (e.g., fake, deepfake, etc.).

FIG. 9 includes example results obtained and/or otherwise produced bythe deepfake analyzer 110 of FIGS. 1, 2A, and/or 2B. In the example ofFIG. 9, a first result set 902 corresponds to results for a firstdataset (e.g., UAVDF dataset). Likewise, an example second result set904 corresponds to results for a second dataset (e.g., VidTimitdataset). In examples disclosed herein, the first dataset (e.g., UAVDFdataset) and/or the second data set (e.g., VidTimit dataset) may beincluded in the input media 118.

While an example manner of implementing the deepfake analyzer 110 ofFIG. 1 is illustrated in FIGS. 2A and/or 2B, one or more of theelements, processes and/or devices illustrated in FIGS. 2A and/or 2B maybe combined, divided, re-arranged, omitted, eliminated and/orimplemented in any other way. Further, the example network interface200, the example component interface 202, the example eye detectionmodel manager 204, the example blur detection model manager 206, theexample local binary model manager 208, the example filter model manager210, the example image quality assessor 212, the example classifier 214,the example score analyzer 216, the example report generator 218, theexample data store 220, and/or, more generally, the example deepfakeanalyzer 110 of FIG. 1 may be implemented by hardware, software,firmware and/or any combination of hardware, software and/or firmware.Thus, for example, any of the example network interface 200, the examplecomponent interface 202, the example eye detection model manager 204,the example blur detection model manager 206, the example local binarymodel manager 208, the example filter model manager 210, the exampleimage quality assessor 212, the example classifier 214, the examplescore analyzer 216, the example report generator 218, the example datastore 220, and/or, more generally, the example deepfake analyzer 110 ofFIG. 1 could be implemented by one or more analog or digital circuit(s),logic circuits, programmable processor(s), programmable controller(s),graphics processing unit(s) (GPU(s)), digital signal processor(s)(DSP(s)), application specific integrated circuit(s) (ASIC(s)),programmable logic device(s) (PLD(s)) and/or field programmable logicdevice(s) (FPLD(s)). When reading any of the apparatus or system claimsof this patent to cover a purely software and/or firmwareimplementation, at least one of the example network interface 200, theexample component interface 202, the example eye detection model manager204, the example blur detection model manager 206, the example localbinary model manager 208, the example filter model manager 210, theexample image quality assessor 212, the example classifier 214, theexample score analyzer 216, the example report generator 218, and theexample data store 220 is/are hereby expressly defined to include anon-transitory computer readable storage device or storage disk such asa memory, a digital versatile disk (DVD), a compact disk (CD), a Blu-raydisk, etc. including the software and/or firmware. Further still, theexample deepfake analyzer 110 of FIG. 1 may include one or moreelements, processes and/or devices in addition to, or instead of, thoseillustrated in FIGS. 2A and/or 2B, and/or may include more than one ofany or all of the illustrated elements, processes and devices. As usedherein, the phrase “in communication,” including variations thereof,encompasses direct communication and/or indirect communication throughone or more intermediary components, and does not require directphysical (e.g., wired) communication and/or constant communication, butrather additionally includes selective communication at periodicintervals, scheduled intervals, aperiodic intervals, and/or one-timeevents.

Flowcharts representative of example hardware logic, machine readableinstructions, hardware implemented state machines, and/or anycombination thereof for implementing the deepfake analyzer 110 of FIGS.1, 2A, and/or 2B are shown in FIGS. 10 and/or 11. The machine readableinstructions may be one or more executable programs or portion(s) of anexecutable program for execution by a computer processor such as theprocessor 1212 shown in the example processor platform 1200 discussedbelow in connection with FIG. 12. The program may be embodied insoftware stored on a non-transitory computer readable storage mediumsuch as a CD-ROM, a floppy disk, a hard drive, a DVD, a Blu-ray disk, ora memory associated with the processor 1212, but the entire programand/or parts thereof could alternatively be executed by a device otherthan the processor 1212 and/or embodied in firmware or dedicatedhardware. Further, although the example program is described withreference to the flowcharts illustrated in FIGS. 10 and/or 11 many othermethods of implementing the example deepfake analyzer 110 mayalternatively be used. For example, the order of execution of the blocksmay be changed, and/or some of the blocks described may be changed,eliminated, or combined. Additionally or alternatively, any or all ofthe blocks may be implemented by one or more hardware circuits (e.g.,discrete and/or integrated analog and/or digital circuitry, an FPGA, anASIC, a comparator, an operational-amplifier (op-amp), a logic circuit,etc.) structured to perform the corresponding operation withoutexecuting software or firmware.

The machine readable instructions described herein may be stored in oneor more of a compressed format, an encrypted format, a fragmentedformat, a compiled format, an executable format, a packaged format, etc.Machine readable instructions as described herein may be stored as data(e.g., portions of instructions, code, representations of code, etc.)that may be utilized to create, manufacture, and/or produce machineexecutable instructions. For example, the machine readable instructionsmay be fragmented and stored on one or more storage devices and/orcomputing devices (e.g., servers). The machine readable instructions mayrequire one or more of installation, modification, adaptation, updating,combining, supplementing, configuring, decryption, decompression,unpacking, distribution, reassignment, compilation, etc. in order tomake them directly readable, interpretable, and/or executable by acomputing device and/or other machine. For example, the machine readableinstructions may be stored in multiple parts, which are individuallycompressed, encrypted, and stored on separate computing devices, whereinthe parts when decrypted, decompressed, and combined form a set ofexecutable instructions that implement a program such as that describedherein.

In another example, the machine readable instructions may be stored in astate in which they may be read by a computer, but require addition of alibrary (e.g., a dynamic link library (DLL)), a software development kit(SDK), an application programming interface (API), etc. in order toexecute the instructions on a particular computing device or otherdevice. In another example, the machine readable instructions may needto be configured (e.g., settings stored, data input, network addressesrecorded, etc.) before the machine readable instructions and/or thecorresponding program(s) can be executed in whole or in part. Thus, thedisclosed machine readable instructions and/or corresponding program(s)are intended to encompass such machine readable instructions and/orprogram(s) regardless of the particular format or state of the machinereadable instructions and/or program(s) when stored or otherwise at restor in transit.

The machine readable instructions described herein can be represented byany past, present, or future instruction language, scripting language,programming language, etc. For example, the machine readableinstructions may be represented using any of the following languages: C,C++, Java, C #, Perl, Python, JavaScript, HyperText Markup Language(HTML), Structured Query Language (SQL), Swift, etc.

As mentioned above, the example processes of FIGS. 10 and/or 11 may beimplemented using executable instructions (e.g., computer and/or machinereadable instructions) stored on a non-transitory computer and/ormachine readable medium such as a hard disk drive, a flash memory, aread-only memory, a compact disk, a digital versatile disk, a cache, arandom-access memory and/or any other storage device or storage disk inwhich information is stored for any duration (e.g., for extended timeperiods, permanently, for brief instances, for temporarily buffering,and/or for caching of the information). As used herein, the termnon-transitory computer readable medium is expressly defined to includeany type of computer readable storage device and/or storage disk and toexclude propagating signals and to exclude transmission media.

“Including” and “comprising” (and all forms and tenses thereof) are usedherein to be open ended terms. Thus, whenever a claim employs any formof “include” or “comprise” (e.g., comprises, includes, comprising,including, having, etc.) as a preamble or within a claim recitation ofany kind, it is to be understood that additional elements, terms, etc.may be present without falling outside the scope of the correspondingclaim or recitation. As used herein, when the phrase “at least” is usedas the transition term in, for example, a preamble of a claim, it isopen-ended in the same manner as the term “comprising” and “including”are open ended. The term “and/or” when used, for example, in a form suchas A, B, and/or C refers to any combination or subset of A, B, C such as(1) A alone, (2) B alone, (3) C alone, (4) A with B, (5) A with C, (6) Bwith C, and (7) A with B and with C. As used herein in the context ofdescribing structures, components, items, objects and/or things, thephrase “at least one of A and B” is intended to refer to implementationsincluding any of (1) at least one A, (2) at least one B, and (3) atleast one A and at least one B. Similarly, as used herein in the contextof describing structures, components, items, objects and/or things, thephrase “at least one of A or B” is intended to refer to implementationsincluding any of (1) at least one A, (2) at least one B, and (3) atleast one A and at least one B. As used herein in the context ofdescribing the performance or execution of processes, instructions,actions, activities and/or steps, the phrase “at least one of A and B”is intended to refer to implementations including any of (1) at leastone A, (2) at least one B, and (3) at least one A and at least one B.Similarly, as used herein in the context of describing the performanceor execution of processes, instructions, actions, activities and/orsteps, the phrase “at least one of A or B” is intended to refer toimplementations including any of (1) at least one A, (2) at least one B,and (3) at least one A and at least one B.

As used herein, singular references (e.g., “a”, “an”, “first”, “second”,etc.) do not exclude a plurality. The term “a” or “an” entity, as usedherein, refers to one or more of that entity. The terms “a” (or “an”),“one or more”, and “at least one” can be used interchangeably herein.Furthermore, although individually listed, a plurality of means,elements or method actions may be implemented by, e.g., a single unit orprocessor. Additionally, although individual features may be included indifferent examples or claims, these may possibly be combined, and theinclusion in different examples or claims does not imply that acombination of features is not feasible and/or advantageous.

FIG. 10 is a flowchart representative of example machine readableinstructions 1000 that may be executed by a processor to implement theexample deepfake analyzer 110 of FIGS. 1, 2A, and/or 2B to process inputmedia 118.

At block 1002, the example deepfake analyzer 110 of FIGS. 1, 2A, and/or2B obtains the example AI model 112. (Block 1002). In examples disclosedherein, the example network interface 200 of FIG. 2A obtains the exampleAI model 112 from the example AI trainer 104 via the example network106. For example, the network interface 200 may receive the AI model 112(e.g., instructions that identify a set of weights to apply to theneurons of a CNN to implement the trained model) from the example AItrainer 104.

At block 1004, the deepfake analyzer 110 obtains the example input media118. (Block 1004). In examples disclosed herein, the network interface200 of FIG. 2A is configured to obtain example the input media 118.

At block 1006, the deepfake analyzer 110 detects a face on a frame ofthe input media 118. (Block 1006). In examples disclosed herein, theexample eye detection model manager 204 of FIGS. 2A and/or 2B isconfigured to detect a human face in the input media 118.

In response to the execution of the instructions represented in block1006, the deepfake analyzer 110 identifies facial landmarks of an eye ofthe face based on the detected face. (Block 1008). In examples disclosedherein, the eye detection model manager 204 identifies and/or otherwisedetermines the facial landmarks (e.g., a nose, eyes, mouth, etc.).

At block 1010, the deepfake analyzer 110 determines the eye aspect ratio(EAR) using the facial landmarks. (Block 1010). In examples disclosedherein, the eye detection model manager 204 determines (e.g.,calculates) an eye aspect ratio (EAR) by executing computer readableinstructions represented in equation 1 above.

At block 1012, the deepfake analyzer 110 detects whether an eye blinkoccurred. (Block 1012). In examples disclosed herein, the eye detectionmodel manager 204 detects whether a blink occurred if the EAR satisfiesa threshold. For example, if the EAR is less than a threshold, the eyedetection model manager 204 may determine a blink occurred.

In the event the deepfake analyzer 110 (e.g., the eye detection modelmanager 204) determines that an eye blink occurred (e.g., the control ofblock 1012 returns a result of YES), then the deepfake analyzer 110generates a result as a binary value of 1. (Block 1014). In examplesdisclosed herein, the eye detection model manager 204 generates a resultas a binary value of 1 in response to detecting a blink has occurred.

Alternatively, in the event the deepfake analyzer 110 (e.g., the eyedetection model manager 204) determines that an eye blink did not occur(e.g., the control of block 1012 returns a result of NO), the deepfakeanalyzer 110 generates a result as a binary value of 0. (Block 1016). Inexamples disclosed herein, the eye detection model manager 204 generatesa result as a binary value of 0 in response to detecting a blink has notoccurred.

Responsive to the execution of the instructions represented blocks 1014or 1016, the deepfake analyzer 110 convolves a frame of the input media118 by the Laplacian kernel. (Block 1018). In examples disclosed herein,the example blur detection model manager 206 of FIGS. 2A and/or 2B isconfigured to convolve the input media 118 by the Laplacian kernel.

At block 1020, the deepfake analyzer 110 determines (e.g., calculates)the variance of the result of the instructions represented in block1018. (Block 1020). In examples disclosed herein, the blur detectionmodel manager 206 determines (e.g., calculate) the variance of theresult.

At block 1022, the deepfake analyzer 110 determines whether there is anadditional frame to analyze. (Block 1022). In examples disclosed herein,the blur detection model manager 206 determines whether there is anadditional frame to analyze. In the event the deepfake analyzer 110(e.g., the blur detection model manager 206) determines there is anadditional frame to analyze (e.g., the control of block 1022 returns aresult of YES), the process returns to block 1018.

Alternatively, in the event the deepfake analyzer 110 (e.g., the blurdetection model manager 206) determines that there are no additionalframes to analyze (e.g., the control of block 1022 returns a result ofNO), the deepfake analyzer 110 executes a Local Binary Pattern (LPB)operation (e.g., technique) on a frame of the input media 118. (Block1024). In examples disclosed herein, the local binary model manager 208executes a Local Binary Pattern (LBP) technique to compute a localrepresentation of texture of a frame of the input media 118. Forexample, the local binary model manager 208 compares each pixel with itssurrounding neighborhood of pixels in the input media 118.

Accordingly, the deepfake analyzer 110 produces a histogramcorresponding to various features and/or changes in texture in the inputmedia 118. (Block 1026). In examples disclosed herein, the local binarymodel manager 208 produces a histogram corresponding to various featuresand/or changes in texture in the input media 118.

At block 1028, the deepfake analyzer 110 determines whether there is anadditional frame to analyze. (Block 1028). In examples disclosed herein,the local binary model manager 208 determines whether there is anadditional frame to analyze. In the event the deepfake analyzer 110(e.g., the local binary model manager 208) determines there is anadditional frame to analyze (e.g., the control of block 1028 returns aresult of YES), the process returns to block 1024.

Alternatively, in the event the deepfake analyzer 110 (e.g., the localbinary model manager 208) determines that there are no additional framesto analyze (e.g., the control of block 1028 returns a result of NO), theprocess proceeds to block 1102 of FIG. 11.

FIG. 11 is a flowchart representative of example machine readableinstructions 1100 that may be executed by a processor to implement theexample deepfake analyzer 110 of FIGS. 1, 2A, and/or 2B to process inputmedia 118.

At block 1102, the deepfake analyzer 110 convolves a frame of the inputmedia 118 with a kernel or mask. (Block 1102). In examples disclosedherein, the filter model manager 210 may appl Gabor filters to the inputmedia 118 by convolving a kernel or mask with the input media 118 which,in turn, filters certain frequencies or signals from the input media118.

In response to the execution of the instructions represented in block1102, the deepfake analyzer 110 generates a resultant image. (Block1104). In examples disclosed herein, the filter model manager 210generates a result image. For example, when the filter model manager 210applies a Gabor filter to the input media 118, the result is acorresponding combination of signals extracted from the frame(s) of theinput media 118. For example, the filter model manager 210 may executethe instructions represented by equation 2, above.

At block 1106, the deepfake analyzer 110 determines whether there is anadditional frame to analyze. (Block 1106). In examples disclosed herein,the filter model manager 210 determines whether there is an additionalframe to analyze. In the event the deepfake analyzer 110 (e.g., thefilter model manager 210) determines there is an additional frame toanalyze (e.g., the control of block 1106 returns a result of YES), theprocess returns to block 1102.

Alternatively, in the event the deepfake analyzer 110 (e.g., the filtermodel manager 210) determines that there are no additional frames toanalyze (e.g., the control of block 1106 returns a result of NO), thedeepfake analyzer fits a frame of the input media 118 to a distribution(e.g., a Generalized Gaussian Distribution and/or an Asymmetric GaussianDistribution). (Block 1108). In examples disclosed herein, the imagequality assessor 212 fits a frame of the input media 118 to adistribution (e.g., a Generalized Gaussian Distribution and/or anAsymmetric Gaussian Distribution).

In response to the instructions represented in block 1108, the deepfakeanalyzer 110 extracts features of the distribution. (Block 1110). Inexamples disclosed herein, the example image quality assessor 212extracts different features from the input media 118. In examplesdisclosed herein, the features extracted by the image quality assessor212 may be referred to as a result of the image quality assessor 212.

At block 1112, the deepfake analyzer 110 determines whether there is anadditional frame to analyze. (Block 1112). In examples disclosed herein,the image quality assessor 212 determines whether there is an additionalframe to analyze. In the event the deepfake analyzer 110 (e.g., theimage quality assessor 212) determines there is an additional frame toanalyze (e.g., the control of block 1112 returns a result of YES), theprocess returns to block 1108.

Alternatively, in the event the deepfake analyzer 110 (e.g., the imagequality assessor 212) determines that there are no additional frames toanalyze (e.g., the control of block 1112 returns a result of NO), thedeepfake analyzer 110 generates a probability based on the output of thelocal binary model manager 208. (Block 1114). In examples disclosedherein, the classifier 214 obtains the output (e.g., result) from thelocal binary model manager 208 (e.g., a histogram corresponding tovarious features and/or changes in texture) and generates a probabilitycorresponding to the likelihood that the input media 118 is authentic ora deepfake.

At block 1116, the deepfake analyzer 110 generates a probability basedon the output of the filter model manager 210. (Block 1116). In examplesdisclosed herein, the classifier 214 obtains the output (e.g., result)from the filter model manager 210 (e.g., a histogram corresponding to afinal signal of the filter model manager 210) and generates aprobability corresponding to the likelihood that the input media 118 isauthentic or a deepfake.

At block 1118, the deepfake analyzer 110 generates a probability basedon the output of the image quality assessor 212. (Block 1118). Inexamples disclosed herein, the classifier 214 obtains the output (e.g.,result) from the image quality assessor 212 (e.g., extracted features)and generates a probability corresponding to the likelihood that theinput media 118 is authentic or a deepfake.

At block 1120, the deepfake analyzer 110 generates a score. (Block1120). In examples disclosed herein, the score analyzer 216 utilizes analgorithm to combine the result of the eye detection model manager 204,the result of the blur detection model manager 206, the probabilitygenerated by the classifier 214 corresponding to the result of the localbinary model manager 208, the probability generated by the classifier214 corresponding to the result of the filter model manager 210, and/orthe probability generated by the classifier 214 corresponding to theresult of the image quality assessor 212 to generate a score. Inexamples disclosed herein, the score analyzer 216 may use equation 3above to generate the score.

At block 1122, the deepfake analyzer 110 determines whether the scoresatisfies a score threshold. (Block 1122). In examples disclosed herein,the report generator 218 determines whether the score satisfies a scorethreshold. For example, if the score is greater than or equal to 0 andless than or equal to 0.5, the report generator 218 determines that theinput media 118 is a deepfake. Alternatively, if the score is between a0.50 and a 1.0 (e.g., greater than 0.50 and less than or equal to 1),the report generator 218 determines that the input media 118 isauthentic.

In the event the deepfake analyzer 110 (e.g., the report generator 218)determines the score satisfies a score threshold (e.g., the control ofblock 1122 returns a result of YES), the example deepfake analyzer 110generates a report identifying and/or including the input media 118 asauthentic. (Block 1124). In examples disclosed herein, the reportgenerator 218, responsive to determining that the score satisfies ascore threshold, generates a report identifying and/or including theinput media 118 as authentic.

In the event the deepfake analyzer 110 (e.g., the report generator 218)determines the score does not satisfy a score threshold (e.g., thecontrol of block 1122 returns a result of NO), the example deepfakeanalyzer 110 generates a report identifying and/or including the inputmedia 118 as a deepfake. (Block 1126). In examples disclosed herein, thereport generator 218, responsive to determining that the score does notsatisfy a score threshold, generates a report identifying and/orincluding the input media 118 as a deepfake.

Responsive to the instructions represented in either block 1124 or block1126, the deepfake analyzer 110 determines whether there is additionalmedia to analyze. (Block 1128). In examples disclosed herein, thenetwork interface 200 determines whether there is additional media toanalyze.

In the event the deepfake analyzer 110 (e.g., the network interface 200)determines that there is additional media to analyze (e.g., the controlof block 1128 returns a result of YES), control returns to block 1002 ofFIG. 10. Alternatively, in the event the deepfake analyzer 110 (e.g.,the network interface 200) determines that there is no additional mediato analyze (e.g., the control of block 1128 returns a result of NO), theprocess stops.

FIG. 12 is a block diagram of an example processor platform 1200structured to execute the instructions of FIGS. 10 and/or 11 toimplement the deepfake analyzer 110 of FIGS. 1, 2A, and/or 2B. Theprocessor platform 1200 can be, for example, a server, a personalcomputer, a workstation, a self-learning machine (e.g., a neuralnetwork), a mobile device (e.g., a cell phone, a smart phone, a tabletsuch as an iPad™), a personal digital assistant (PDA), an Internetappliance, a DVD player, a CD player, a digital video recorder, aBlu-ray player, a gaming console, a personal video recorder, a set topbox, a headset or other wearable device, or any other type of computingdevice.

The processor platform 1200 of the illustrated example includes aprocessor 1212. The processor 1212 of the illustrated example ishardware. For example, the processor 1212 can be implemented by one ormore integrated circuits, logic circuits, microprocessors, GPUs, DSPs,or controllers from any desired family or manufacturer. The hardwareprocessor may be a semiconductor based (e.g., silicon based) device. Inthis example, the processor implements the example network interface200, the example component interface 202, the example eye detectionmodel manager 204, the example blur detection model manager 206, theexample local binary model manager 208, the example filter model manager210, the example image quality assessor 212, the example classifier 214,the example score analyzer 216, the example report generator 218, theexample data store 220, and/or, more generally, the example deepfakeanalyzer 110 of FIG. 1.

The processor 1212 of the illustrated example includes a local memory1213 (e.g., a cache). The processor 1212 of the illustrated example isin communication with a main memory including a volatile memory 1214 anda non-volatile memory 1216 via a bus 1218. The volatile memory 1214 maybe implemented by Synchronous Dynamic Random Access Memory (SDRAM),Dynamic Random Access Memory (DRAM), RAMBUS® Dynamic Random AccessMemory (RDRAM®) and/or any other type of random access memory device.The non-volatile memory 1216 may be implemented by flash memory and/orany other desired type of memory device. Access to the main memory 1214,1216 is controlled by a memory controller.

The processor platform 1200 of the illustrated example also includes aninterface circuit 1220. The interface circuit 1220 may be implemented byany type of interface standard, such as an Ethernet interface, auniversal serial bus (USB), a Bluetooth® interface, a near fieldcommunication (NFC) interface, and/or a PCI express interface.

In the illustrated example, one or more input devices 1222 are connectedto the interface circuit 1220. The input device(s) 1222 permit(s) a userto enter data and/or commands into the processor 1212. The inputdevice(s) can be implemented by, for example, an audio sensor, amicrophone, a camera (still or video), a keyboard, a button, a mouse, atouchscreen, a track-pad, a trackball, isopoint and/or a voicerecognition system.

One or more output devices 1224 are also connected to the interfacecircuit 1220 of the illustrated example. The output devices 1224 can beimplemented, for example, by display devices (e.g., a light emittingdiode (LED), an organic light emitting diode (OLED), a liquid crystaldisplay (LCD), a cathode ray tube display (CRT), an in-place switching(IPS) display, a touchscreen, etc.), a tactile output device, a printerand/or speaker. The interface circuit 1220 of the illustrated example,thus, typically includes a graphics driver card, a graphics driver chipand/or a graphics driver processor.

The interface circuit 1220 of the illustrated example also includes acommunication device such as a transmitter, a receiver, a transceiver, amodem, a residential gateway, a wireless access point, and/or a networkinterface to facilitate exchange of data with external machines (e.g.,computing devices of any kind) via a network 1226. The communication canbe via, for example, an Ethernet connection, a digital subscriber line(DSL) connection, a telephone line connection, a coaxial cable system, asatellite system, a line-of-site wireless system, a cellular telephonesystem, etc.

The processor platform 1200 of the illustrated example also includes oneor more mass storage devices 1228 for storing software and/or data.Examples of such mass storage devices 1228 include floppy disk drives,hard drive disks, compact disk drives, Blu-ray disk drives, redundantarray of independent disks (RAID) systems, and digital versatile disk(DVD) drives.

The machine executable instructions 1232 of FIGS. 10 and/or 11 may bestored in the mass storage device 1228, in the volatile memory 1214, inthe non-volatile memory 1216, and/or on a removable non-transitorycomputer readable storage medium such as a CD or DVD.

A block diagram illustrating an example software distribution platform1305 to distribute software such as the example computer readableinstructions 1232 of FIG. 12 to third parties is illustrated in FIG. 13.The example software distribution platform 1305 may be implemented byany computer server, data facility, cloud service, etc., capable ofstoring and transmitting software to other computing devices. The thirdparties may be customers of the entity owning and/or operating thesoftware distribution platform. For example, the entity that owns and/oroperates the software distribution platform may be a developer, aseller, and/or a licensor of software such as the example computerreadable instructions 1232 of FIG. 12. The third parties may beconsumers, users, retailers, OEMs, etc., who purchase and/or license thesoftware for use and/or re-sale and/or sub-licensing. In the illustratedexample, the software distribution platform 1305 includes one or moreservers and one or more storage devices. The storage devices store thecomputer readable instructions 1232, which may correspond to the examplecomputer readable instructions 1000, 1100 of FIGS. 10 and/or 11, asdescribed above. The one or more servers of the example softwaredistribution platform 1305 are in communication with a network 1310,which may correspond to any one or more of the Internet and/or any ofthe example networks (e.g., the network 106 of FIG. 1) described above.In some examples, the one or more servers are responsive to requests totransmit the software to a requesting party as part of a commercialtransaction. Payment for the delivery, sale and/or license of thesoftware may be handled by the one or more servers of the softwaredistribution platform and/or via a third party payment entity. Theservers enable purchasers and/or licensors to download the computerreadable instructions 1232 from the software distribution platform 1305.For example, the software, which may correspond to the example computerreadable instructions 1000, 1100 of FIGS. 10 and/or 111 may bedownloaded to the example processor platform 1200, which is to executethe computer readable instructions 1232 to implement the deepfakeanalyzer 110. In some example, one or more servers of the softwaredistribution platform 1305 periodically offer, transmit, and/or forceupdates to the software (e.g., the example computer readableinstructions 1232 of FIG. 12) to ensure improvements, patches, updates,etc. are distributed and applied to the software at the end userdevices.

From the foregoing, it will be appreciated that example methods,apparatus and articles of manufacture have been disclosed that utilize aunique combination of five different computer vision techniques.Moreover, examples disclosed herein include utilizing multiple Gaborkernels to extract different signals from input media (e.g., an image, aframe of a video, etc.). Examples disclosed herein further extend imagequality assessment techniques to extract texture patterns in input media(e.g., an image, a frame of a video, etc.). Examples disclosed hereinutilize the above-mentioned methods to generate a score to combine theresults of each technique to more efficiently control false positivesand false negatives when detecting deepfakes. For example, examplesdisclosed herein utilize computer techniques and machine learningtechniques to generate individual results and/or otherwise scorescorresponding to extracted features, a blur score, an eye blink, etc.,and, using such results to determine whether input media (e.g., a video)is authentic or fake (e.g., a deepfake). The disclosed methods,apparatus and articles of manufacture improve the efficiency of using acomputing device by efficiently detecting deepfake videos. The disclosedmethods, apparatus and articles of manufacture are accordingly directedto one or more improvement(s) in the functioning of a computer.

Although certain example methods, apparatus and articles of manufacturehave been disclosed herein, the scope of coverage of this patent is notlimited thereto. On the contrary, this patent covers all methods,apparatus and articles of manufacture fairly falling within the scope ofthe claims of this patent.

Example methods, apparatus, systems, and articles of manufacture todetect deepfake content are disclosed herein. Further examples andcombinations thereof include the following:

Example 1 includes an apparatus to determine whether input media isauthentic, the apparatus comprising a classifier to generate a firstprobability based on a first output of a local binary model manager, asecond probability based on a second output of a filter model manager,and a third probability based on a third output of an image qualityassessor, and a score analyzer to obtain the first, second, and thirdprobabilities from the classifier, and in response to obtaining a firstresult and a second result, generate a score indicative of whether theinput media is authentic based on the first result, the second result,the first probability, the second probability, and the thirdprobability.

Example 2 includes the apparatus of example 1, wherein the input mediais authentic when the score is less than a score threshold.

Example 3 includes the apparatus of example 1, further including afilter model manager to generate the second output by applying a Gaborfilter to a frame of the input media, and extracting signals from theframe of the input media responsive to the Gabor filter being applied,the signals corresponding to changes in texture in the input media.

Example 4 includes the apparatus of example 1, further including a blurdetection model manager to generate the second result, the second resultrepresentative of a degree of blur in frames of the input media.

Example 5 includes the apparatus of example 1, further including an eyedetection model manager to generate the first result, the first resultbeing a binary value indicative of whether a blink occurred in a humanface in the input media.

Example 6 includes the apparatus of example 5, wherein the eye detectionmodel manager is to determine that the blink occurred when a ratio ofpoints in an eye satisfies a threshold for four frames of the inputmedia.

Example 7 includes the apparatus of example 1, wherein the first,second, and third probabilities correspond to a likelihood that theinput media is a deepfake.

Example 8 includes a non-transitory computer readable medium comprisinginstructions which, when executed, cause at least one processor togenerate a first probability based on a first output of a local binarymodel manager, a second probability based on a second output of a filtermodel manager, and a third probability based on a third output of animage quality assessor, and in response to obtaining a first result anda second result, generate a score indicative of whether input media isauthentic based on the first result, the second result, the firstprobability, the second probability, and the third probability.

Example 9 includes the non-transitory computer readable medium ofexample 8, wherein the instructions, when executed, cause the at leastone processor to determine the input media is authentic when the scoreis less than a score threshold.

Example 10 includes the non-transitory computer readable medium ofexample 8, wherein the instructions, when executed, cause the at leastone processor to generate the second output by applying a Gabor filterto a frame of the input media, and extracting signals from the frame ofthe input media responsive to the Gabor filter being applied, thesignals corresponding to changes in texture in the input media.

Example 11 includes the non-transitory computer readable medium ofexample 8, wherein the second result is representative of a degree ofblur in frames of the input media.

Example 12 includes the non-transitory computer readable medium ofexample 8, wherein the first result is a binary value indicative ofwhether a blink occurred in a human face in the input media.

Example 13 includes the non-transitory computer readable medium ofexample 12, wherein the instructions, when executed, cause the at leastone processor to determine that the blink occurred when a ratio ofpoints in an eye satisfies a threshold for four frames of the inputmedia.

Example 14 includes the non-transitory computer readable medium ofexample 8, wherein the first, second, and third probabilities correspondto a likelihood that the input media is a deepfake.

Example 15 includes a method to determine whether input media isauthentic, the method comprising generating a first probability based ona first output of a local binary model manager, a second probabilitybased on a second output of a filter model manager, and a thirdprobability based on a third output of an image quality assessor, and inresponse to obtaining a first result and a second result, generating ascore indicative of whether corresponding input media is authentic basedon the first result, the second result, the first probability, thesecond probability, and the third probability. 16, the method of example15, further including determining the input media is authentic when thescore is less than a score threshold.

Example 17 includes the method of example 15, further includinggenerating the second output by applying a Gabor filter to a frame ofthe input media, and extracting signals from the frame of the inputmedia responsive to the Gabor filter being applied, the signalscorresponding to changes in texture in the input media.

Example 18 includes the method of example 15 wherein the second resultis representative of a degree of blur in frames of the input media.

Example 19 includes the method of example 15, wherein the first resultis a binary value indicative of whether a blink occurred in a human facein the input media.

Example 20 includes the method of example 19, further includingdetermine that the blink occurred when a ratio of points in an eyesatisfies a threshold for four frames of the input media.

Example 21 includes the method of example 15, wherein the first, second,and third probabilities correspond to a likelihood that the input mediais a deepfake.

Example 22 includes a server to distribute first instructions on anetwork, the server comprising at least one storage device includingsecond instructions, and at least one processor to execute the secondinstructions to transmit the first instructions over the network, thefirst instructions, when executed, to cause at least one device togenerate a first probability based on a first output of a local binarymodel manager, a second probability based on a second output of a filtermodel manager, and a third probability based on a third output of animage quality assessor, and in response to obtaining a first result anda second result, generate a score indicative of whether input media isauthentic based on the first result, the second result, the firstprobability, the second probability, and the third probability.

Example 23 includes the server of example 22, wherein the firstinstructions, when executed, cause the at least one device to determinethe input media is authentic when the score is less than a scorethreshold.

Example 24 includes the server of example 22, wherein the firstinstructions, when executed, cause the at least one device to generatethe second output by applying a Gabor filter to a frame of the inputmedia, and extracting signals from the frame of the input mediaresponsive to the Gabor filter being applied, the signals correspondingto changes in texture in the input media.

Example 25 includes the server of example 22, wherein the second resultis representative of a degree of blur in frames of the input media.

Example 26 includes the server of example 22, wherein the first resultis a binary value indicative of whether a blink occurred in a human facein the input media.

Example 27 includes the server of example 26, wherein the firstinstructions, when executed, cause the at least one device to determinethat the blink occurred when a ratio of points in an eye satisfies athreshold for four frames of the input media.

Example 28 includes the server of example 22, wherein the first, second,and third probabilities correspond to a likelihood that the input mediais a deepfake.

1. An apparatus to determine whether input media is authentic, theapparatus comprising: a classifier to generate a first probability basedon a first output of a local binary model manager, a second probabilitybased on a second output of a filter model manager, and a thirdprobability based on a third output of an image quality assessor; and ascore analyzer to: obtain the first, second, and third probabilitiesfrom the classifier; and in response to obtaining a first result and asecond result, generate a score indicative of whether the input media isauthentic based on the first result, the second result, the firstprobability, the second probability, and the third probability.
 2. Theapparatus of claim 1, wherein the input media is authentic when thescore is less than a score threshold.
 3. The apparatus of claim 1,further including a filter model manager to generate the second outputby: applying a Gabor filter to a frame of the input media; andextracting signals from the frame of the input media responsive to theGabor filter being applied, the signals corresponding to changes intexture in the input media.
 4. The apparatus of claim 1, furtherincluding a blur detection model manager to generate the second result,the second result representative of a degree of blur in frames of theinput media.
 5. The apparatus of claim 1, further including an eyedetection model manager to generate the first result, the first resultbeing a binary value indicative of whether a blink occurred in a humanface in the input media.
 6. The apparatus of claim 5, wherein the eyedetection model manager is to determine that the blink occurred when aratio of points in an eye satisfies a threshold for four frames of theinput media.
 7. The apparatus of claim 1, wherein the first, second, andthird probabilities correspond to a likelihood that the input media is adeepfake.
 8. A non-transitory computer readable medium comprisinginstructions which, when executed, cause at least one processor to atleast: generate a first probability based on a first output of a localbinary model manager, a second probability based on a second output of afilter model manager, and a third probability based on a third output ofan image quality assessor; and in response to obtaining a first resultand a second result, generate a score indicative of whether input mediais authentic based on the first result, the second result, the firstprobability, the second probability, and the third probability.
 9. Thenon-transitory computer readable medium of claim 8, wherein theinstructions, when executed, cause the at least one processor todetermine the input media is authentic when the score is less than ascore threshold.
 10. The non-transitory computer readable medium ofclaim 8, wherein the instructions, when executed, cause the at least oneprocessor to generate the second output by: applying a Gabor filter to aframe of the input media; and extracting signals from the frame of theinput media responsive to the Gabor filter being applied, the signalscorresponding to changes in texture in the input media.
 11. Thenon-transitory computer readable medium of claim 8, wherein the secondresult is representative of a degree of blur in frames of the inputmedia.
 12. The non-transitory computer readable medium of claim 8,wherein the first result is a binary value indicative of whether a blinkoccurred in a human face in the input media.
 13. The non-transitorycomputer readable medium of claim 12, wherein the instructions, whenexecuted, cause the at least one processor to determine that the blinkoccurred when a ratio of points in an eye satisfies a threshold for fourframes of the input media.
 14. The non-transitory computer readablemedium of claim 8, wherein the first, second, and third probabilitiescorrespond to a likelihood that the input media is a deepfake.
 15. Amethod to determine whether input media is authentic, the methodcomprising: generating a first probability based on a first output of alocal binary model manager, a second probability based on a secondoutput of a filter model manager, and a third probability based on athird output of an image quality assessor; and in response to obtaininga first result and a second result, generating a score indicative ofwhether corresponding input media is authentic based on the firstresult, the second result, the first probability, the secondprobability, and the third probability.
 16. The method of claim 15,further including determining the input media is authentic when thescore is less than a score threshold.
 17. The method of claim 15,further including generating the second output by: applying a Gaborfilter to a frame of the input media; and extracting signals from theframe of the input media responsive to the Gabor filter being applied,the signals corresponding to changes in texture in the input media. 18.The method of claim 15 wherein the second result is representative of adegree of blur in frames of the input media.
 19. The method of claim 15,wherein the first result is a binary value indicative of whether a blinkoccurred in a human face in the input media.
 20. The method of claim 19,further including determine that the blink occurred when a ratio ofpoints in an eye satisfies a threshold for four frames of the inputmedia. 21.-28. (canceled)